CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/08/09 13:22:49
Modified files:
sys/kern : subr_disk.c
Log message:
Reject d_secsize exceeding MAXPHYS in (init|set)disklabel
readdisklabel() reads one sector into one buffer with
geteblk(d_secsize), and vnd(4) takes d_secsize from userland. The
buffer cache allocates kva one MAXPHYS slot per buffer but maps and
unmaps b_bufsize worth of it, so an oversize sector lays one buffer
across the slots that follow and unmaps them when it is freed, leaving
other buffer users with a b_data that is no longer mapped.
ok krw@
Reported-by: [email protected]
